digital-pagamentos-padagio-freflow-oficial[.]xo[.]je

Analysis on July 24, 2026 identifies the domain digital-pagamentos-padagio-freflow-oficial.xo.je as part of an elevated‑risk generic phishing campaign targeting account takeover. The domain was registered on March 22 2026 and currently resolves to the IPv4 address 185.27.134.172, which is allocated to I FastNet LTD in the United Kingdom. Passive DNS and hosting scans show the server is fronted by Cloudflare, delivering content over HTTP/3 and employing LiteSpeed as the web server. The site’s page title returns “Domain Suspended”, indicating that the hosting provider has taken the service offline.

Technical fingerprints reveal PHP, Tailwind CSS and the cdnjs CDN, while the TLS certificate is issued by ZeroSSL. VirusTotal reports that 14 of 94 scanning engines flag the domain as malicious, and the domain appears on a single open‑source blocklist that is actively used by PhishDestroy, which has already blocked the host. The reported scam type is “Account Takeover”, suggesting that the infrastructure was intended to harvest credentials for financial or service accounts. Despite the offline status, the infrastructure remains observable and could be re‑activated.

No additional intelligence such as malicious payload hashes, phishing page screenshots, or victim reports is publicly available, leaving the exact phishing kit and target list unknown. Defenders should continue to block the domain at network perimeters, enforce DNS sink‑holing for the resolved IP, and monitor for any re‑registration attempts. Because the domain is already listed by PhishDestroy, integrating that blocklist into security appliances will provide immediate mitigation. Continuous re‑scanning on VirusTotal and periodic WHOIS checks are recommended to detect any changes in hosting or certificate issuance that could indicate a resurgence of the campaign.